How to remove quiz / Web trends graphics from Windows search bar

[charliefarnsbarns]

Everything:

C:\Users\User\AppData\Local\WhatsApp\app-2.2216.7\resources\app.asar.unpacked\node_modules\ node-quarantine
C:\Users\User\AppData\Local\WhatsApp\app-2.2216.8\resources\app.asar.unpacked\node_modules\ node-quarantine
C:\AdwCleaner\Quarantine
C:\FRST\Quarantine
C:\Program Files (x86)\Adware Removal Tool by TSA\Quarantine
C:\ProgramData\Microsoft\Windows Defender\Quarantine
C:\Users\User\AppData\Roaming\ZHP\Quarantine
C:\Users\User\AppData\Roaming\ZHP\Quarantine\ZHPCl eaner\SecuritySuite\Quarantine
C:\Users\User\AppData\Roaming\ZHP\Quarantine\ZHPCl eaner\SecuritySuite\SecuritySuite\Quarantine
C:\Users\User\AppData\Local\WhatsApp\app-2.2216.7\resources\app.asar.unpacked\node_modules\ node-quarantine\bin\win32-x64-87\node-quarantine.node
C:\Users\User\AppData\Local\WhatsApp\app-2.2216.8\resources\app.asar.unpacked\node_modules\ node-quarantine\bin\win32-x64-87\node-quarantine.node

[charliefarnsbarns]

Here is the ZHP Diag3 report, attached.

[charliefarnsbarns]

Thanks for the Xam recommendation, installing it now to run alongside Windows Defender

[charliefarnsbarns]

If this looks like we’ve got it all fixed / sorted, I hope you’ll let me know if there’s something I can do for you in return. Buy you a coffee/drink or send an amazon gift voucher, to show my appreciation?

[Malnutrition]

I will take a look at the Zhp log when I get home. I personally do not need anything but if you wish you can make a donation to the forum. Just standby one more set of instructions. Here in a couple of hours
We will clean the tools used and create a new restore point etc.

[charliefarnsbarns]

It’s coming up to midnight here now, I might be online for another 30mins or so… Otherwise any instructions I will follow first thing before I go to work. Very happy to donate to the forum.

[Malnutrition]

No problem get some sleep, I am looking things over now.

[Malnutrition]

FRST Fix.

Download attached fixlist.txt file and save it to the Desktop. NOTE. It’s important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

---

Something suspicious I missed earlier.
[COLOR=rgb(184, 49, 47)]bl (HKLM-x32...{2A075BB4-E976-4278-BF3F-E5C6945D84C0}) (Version: 1.0.0 - Your Company Name) Hidden

After the fixlist reboots the machine. Then go to the Control Panel, Program Features and remove what seems to be labeled as [COLOR=rgb(184, 49, 47)]bl. [/COLOR][COLOR=rgb(184, 49, 47)]
FRST64 will only unhide the entry. The removal must be done manually. You can use Geekuninstaller force mode if needed.

---

Disable windows 10 spyware with O&O software, this can chew up bandwidth while you game as microsoft is constantly uploading various data from your machine.

Disable windows update, and only enable it once a week to update on your terms not whenever microsoft feels you need an update.

Uninstall Useless to you windows apps with O&O App buster.

---

Uninstall the following with GeekUninstaller, they are useless and waste system resources. (Your choice optional as these are not malware, just bloatware.)

Dell Digital Delivery Services (HKLM-x32...{560DFD4A-23E2-45DD-A223-A4B3FA356913}) (Version: 4.0.92.0 - Dell Inc.)
Dell SupportAssist (HKLM...{D5BD7604-A1C8-47DC-8C0A-70F9BED27245}) (Version: 3.11.1.18 - Dell Inc.)
Dell SupportAssist OS Recovery Plugin for Dell Update (HKLM-x32...{2a8bafd6-22ae-4d0e-87a4-686b2a4a2ab0}) (Version: 5.5.1.16143 - Dell Inc.)
Dell Update (HKLM-x32...{372F0A07-77E0-4CE6-ADA2-91820D7C5B1B}) (Version: 1.9.8.0 - Dell Inc.)[/color][/COLOR]

[Malnutrition]

Well looking at the logs again I always triple check, I found this, you will need to run this fixlist and then remove the program named PH

ph (HKLM-x32...{185F9795-9663-4F13-9EF9-307A282ADB5A}) (Version: 1.0.0 - Your Company Name) Hidden

[charliefarnsbarns]

Good morning Malnutrition! I ran your “bh” fixlist last night, the log for that is attached here… I relabelled it Fixlog-1. I then removed it using GeekUninstaller, while getting rid of all the Dell bloatware you highlighted.

This morning I ran your next fixlist for the “ph” program, in fact I ran it twice - and on the second occasion this prompted an “uninstall” window to appear for “ph”, so I did that. There are two logs from this morning - Fixlog-2 and Fixlog-3.
I also downloaded the two O&O programs, I made some adjustments. With the spyware one, when one wants to disable something, am I correct in thinking you shift the slider right to enable i.e. you are enabling the blocker which then disables that function?? Or, should I slide it left to disable? Other than possibly misunderstanding how the slider worked on that program, I think I’ve done everything you recommended and hopefully we’re done.

[charliefarnsbarns]

One small thing though… Microsoft Defender antivirus will not activate and a message says I should contact my IT administrator. On the Virus & threat Protection tab, pressing the button to activate the service does nothing except bring up an animated graphic of flying blue dots, as if it’s thinking about it but can’t do it. I’m wondering if I’ve somehow switched Defender off?
I downloaded & installed your recommended Xvirus Anti-malware yesterday which seems to be working fine, might this have cancelled out Defender?
Sorry, so many questions!
heading off to work now but when I get back tonight I’ll review and action any further advice you may have. Thanks once again for all your support

[Malnutrition]

Xvirus Anti-malware yesterday which seems to be working fine, might this have cancelled out Defender

Perhaps it did, I do not have a windows 10 machine to test…

This fix below will reset windows defender to default, just in case. But you should be fine so long as you are not downloading a bunch of random stuff onto your machine. If you do download anything, then check it at virustotal first before opening it onto your machine. I suggest that you install Ublock Origin on the machine as well.

---

FRST Fix.

Download attached fixlist.txt file and save it to the Desktop. NOTE. It’s important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

---

am I correct in thinking you shift the slider right to enable i.e. you are enabling the blocker which then disables that function

Yes that is correct.

[Malnutrition]

@charliefarnsbarns If there is nothing else and you are happy to call this one solved.

Download KpRM
Save to Desktop
Check Delete Tools’
Delete Restore points
Create Restore point.
Then click run.
I’ll Mark this as solved for you.

[charliefarnsbarns]

Once again many thanks for your advice. Yes I think we can mark that solved! I attach the last Fix-log for the Windows Defender FRST fix.
Is the KpRM intended to delete all the programs you sent me? I might keep a few handy, like the adware cleaner

[Malnutrition]

Yes it will delete the tools we used. Just refer back to this thread to download fresh copies these tools are updated frequently.

Marking solved.